NAME
ThunkInitLSF (KERNEL32.41)
SYNOPSIS
LPVOID ThunkInitLSF
(
LPBYTE thunk,
LPCSTR thkbuf,
DWORD len,
LPCSTR dll16,
LPCSTR dll32
)
PARAMS
thunk [In] Win32 thunk.
thkbuf [In] thkbuffer name in Win16 dll.
len [In] length of thkbuffer.
dll16 [In] name of Win16 dll.
[In] name of Win32 dll.
DESCRIPTION
A thunk setup routine. Expects a pointer to a preinitialized thunkbuffer in the first argument looking like:
00..03: unknown (pointer, check _41, _43, _46)
04: EB1E jmp +0x20
06..23: unknown (space for replacement code, check .90)
24:>E800000000 call offset 29
29:>58 pop eax ( target of call )
2A: 2D25000000 sub eax,0x00000025 ( now points to offset 4 )
2F: BAxxxxxxxx mov edx,xxxxxxxx
34: 68yyyyyyyy push KERNEL32.90
39: C3 ret
3A: EB1E jmp +0x20
3E ... 59: unknown (space for replacement code?)
5A: E8xxxxxxxx call <32bitoffset xxxxxxxx>
5F: 5A pop edx
60: 81EA25xxxxxx sub edx, 0x25xxxxxx
66: 52 push edx
67: 68xxxxxxxx push xxxxxxxx
6C: 68yyyyyyyy push KERNEL32.89
71: C3 ret
72: end?
This function checks if the code is there, and replaces the yyyyyyyy entries by the functionpointers. The thunkbuf looks like:
00: DWORD length ? don't know exactly
04: SEGPTR ptr ? where does it point to?
The segpointer pointer is written into the first DWORD of 'thunk'. [ok probably].
RETURNS
unclear, pointer to Win16 thkbuffer?
IMPLEMENTATION
Exported by ordinal only. Use GetProcAddress(3w) to obtain a pointer to the function.
Implemented in "dlls/kernel32/thunk.c".
Debug channel "thunk".